CVE-2026-102762

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

EUVD-2026-89171

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

CVE-2026-102762

The NetX Duo MQTT client contains a vulnerability where it leaks packets carrying malformed PUBLISH messages . The underlying cause is that each malformed message consumes one or more packets from the network driver's receive pool without returning them. A peer sending a few dozen such messages c...

CVE-2026-100245 Stored XSS on Wikibase Special:SetSiteLink via unescaped system message

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100245 Stored XSS on Wikibase Special:SetSiteLink via unescaped system message

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows Stored XSS. This issue affects Mediawiki - Wikibase Extension: from before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-100245

The Wikimedia Foundation Mediawiki - Wikibase Extension is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. Specifically, the vulnerability occurs on Wikibase Special:SetSiteLink when an unescaped system message is proc...

CVE-2026-84782 DTLS Retransmits Handshake Messages From a Stale Buffer Offset

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly...

CVE-2018-10933

CVE-2018-10933 - Omisión de Autenticación en libssh Implementación de Prueba de Concepto para CVE-2018-10933 , una vulnerabilidad crítica de omisión de autenticación que afecta la implementación del lado del servidor de libssh. Aviso legal Este repositorio se proporciona únicamente con fines...

Security update for corosync

This update for corosync fixes the following issue: CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly bsc1278738. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zyppe...

SUSE-SU-2026:4387-1 Security update for corosync

This update for corosync fixes the following issue: - CVE-2026-81665: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly bsc1278738...

CVE-2026-101277

A flaw was found in OpenDKIM. A remote attacker can exploit this vulnerability by sending manipulated email authentication tags to the tag tokenizer, specifically affecting the dkimprocessset function. This flaw causes the application to rely on a less trusted source during processing, potentiall...

PT-2026-102774

Name of the Vulnerable Software and Affected Versions NetX Duo affected versions not specified Description The MQTT client fails to release the packet containing a malformed PUBLISH message. This results in a memory leak where each malformed message consumes a packet or a chain of packets from th...

PT-2026-102680

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A flaw exists when reassembling fragmented WebSocket messages into a GByteArray. The software fails to adequately cap the total message size against the limits of the underlying buffer type. ...

CVE-2026-96274: Uncaught Exception

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdo...

OpenSSL Security Advisory 20260929

OpenSSL Security Advisory 20260929 - The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs t...

CVE-2026-102762: Missing Release of Memory after Effective Lifetime

The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet, or one chain of packets, from the network driver's receive pool, and nothing returns it. A peer that can deliver a few dozen such messages exhausts the pool and stops all inbou...

SUSE CVE-2026-67412

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another...

CVE-2026-101915

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101915 @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...

CVE-2026-101915

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is...